Vietnam's Data Protection Law Applicability Based on Location of Individual Processing Data

Vietnam's Personal Data Protection Decree (PDPD) applies to foreign individuals processing data while physically present in Vietnam, regardless of their ordinary residence.

Text of Relevant Provisions

PDPD Art.1(2)(b):

"This Decree applies to: Foreign authorities, entities and individuals in Vietnam;"

Analysis of Provisions

The PDPD explicitly extends its applicability to "foreign authorities, entities and individuals in Vietnam". This provision directly addresses the factor of "Location of Individual who Processes Data" by including foreign individuals within the scope of the law when they are physically present in Vietnam.

The phrase "in Vietnam" is crucial here, as it establishes the territorial connection required for the law to apply. This means that the PDPD covers data processing activities conducted by foreign individuals who are physically present within Vietnam's territory, regardless of their ordinary place of residence or the location of the data subjects whose information they are processing.

It's important to note that the provision does not distinguish between temporary visitors and long-term residents. The broad language "foreign... individuals in Vietnam" suggests that even short-term visitors engaged in data processing activities while in the country would fall under the law's purview.

Implications

This provision has significant implications for foreign individuals who may be processing personal data while in Vietnam:

1. Tourists or business travelers: Foreign visitors who collect or process personal data during their stay in Vietnam, even for personal or non-commercial purposes, may be subject to the PDPD.
2. Remote workers or digital nomads: Foreign individuals working remotely from Vietnam and processing personal data as part of their job duties would likely fall under the law's scope.
3. Expatriates: Foreign nationals residing in Vietnam, whether temporarily or long-term, would be subject to the PDPD when engaging in data processing activities.
4. Foreign students: International students studying in Vietnam who process personal data for academic or personal projects would need to comply with the PDPD.
5. Foreign journalists or researchers: Those collecting or processing personal data as part of their work while in Vietnam would be covered by the law.

Companies and organizations employing or working with foreign individuals in Vietnam should be aware that these individuals' data processing activities are subject to the PDPD. This may necessitate additional training, compliance measures, and oversight to ensure that foreign staff members adhere to Vietnamese data protection regulations while in the country.

It's worth noting that the provision's broad language could potentially create complex compliance scenarios, especially for short-term visitors who may be unaware of their obligations under Vietnamese law. However, the inclusion of this factor ensures that Vietnam can assert its data protection standards over all data processing activities occurring within its borders, regardless of the processor's nationality or usual place of residence.